feat: add nginx

.gitignore

@@ -5,3 +5,4 @@ instance/
 backup/
 uploads/
 fhost_db.sql/
+ssl/

docker-compose.yml

@@ -1,6 +1,6 @@
 networks:
-  zxz:
-    external: false
+  zxz_nginx_net:
+    driver: bridge
 
 volumes:
   upload_volume:
@@ -17,6 +17,7 @@ services:
     #build:
     #  context: ./
     #  dockerfile: Dockerfile
+    hostname: zxz1
     env_file:
       - .env
     restart: always
@@ -25,9 +26,25 @@ services:
       # - ./instance:/python-docker/instance
       - fhost_db_volume:/python-docker/fhost_db.sql
     networks:
-      - zxz
+      - zxz_nginx_net
+    # ports:
+    #   - "8003:5000"
+
+  nginx:
+    image: nginx:latest
+    container_name: nginx
+    restart: always
+    # network_mode: host # remove if use custom network
     ports:
-      - "8003:5000"
+      - "80:80"
+      - "443:443"
+    extra_hosts:
+      - "mini:192.168.0.146"
+    networks:
+      - zxz_nginx_net
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./ssl:/etc/nginx/ssl:ro
 
   backup:
     image: alpine

nginx.conf

@@ -0,0 +1,51 @@
+http {
+    upstream zxz_url {
+        # ip_hash;
+        # List the Flask app servers in the container
+        server zxz1:5000;
+    }
+
+    server {
+        listen 80;
+        server_name _;  # Accept all server names
+        # server_name yourdomain.com; # Replace with your domain
+
+        location / {
+            proxy_pass http://zxz_url/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    server {
+        listen 443 ssl;
+        server_name _;  # Accept all server names
+        # server_name yourdomain.com; # Replace with your domain
+
+        ssl_certificate /etc/nginx/ssl/nginx.crt;
+        ssl_certificate_key /etc/nginx/ssl/nginx.key;
+
+        # Enable TLS 1.2 and TLS 1.3
+        ssl_protocols TLSv1.2 TLSv1.3;
+
+        # Configure SSL ciphers
+        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
+
+        ssl_prefer_server_ciphers off; # TLS 1.3 has its own cipher suite selection process
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_timeout 1h;
+        ssl_session_tickets off;
+
+        location / {
+            proxy_pass http://zxz_url/;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+}
+
+events {}

ssl/.gitkeep

@@ -0,0 +1,7 @@
+```bash
+# Generate a private key
+openssl genpkey -algorithm RSA -out /etc/nginx/ssl/nginx.key
+
+# Generate a self-signed certificate
+openssl req -new -x509 -key /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt -days 365
+```

zxz_tools.sh

@@ -220,8 +220,8 @@ fi
 
 # Restart server
 if [ ${flag_RESTART} -gt 0 ]; then
-    print_with_color "$ docker compose -f ${docker_compose_yml} restart zxz\n" "\033[36m"
-    eval "docker compose -f ${docker_compose_yml} restart zxz"
+    print_with_color "$ docker compose -f ${docker_compose_yml} restart zxz nginx\n" "\033[36m"
+    eval "docker compose -f ${docker_compose_yml} restart zxz nginx"
     exit 0
 fi
 
@@ -273,7 +273,7 @@ if [ ${flag_START_ZXZ} -gt 0 ] || [ ${flag_BACKUP} -gt 0 ] || [ ${flag_RESTORE}
     if [ ${flag_BUILD} -gt 0 ]; then
         command="${command} --build --force-recreate"
     fi
-    command="${command} -d zxz"
+    command="${command} -d zxz nginx"
     print_with_color "$ ${command}\n" "\033[36m"
     eval "${command}"
 fi